汇编HooK

设计思路

• 远程申请内存
• 利用汇编指令在系统API开头劫持跳转
• 当自己的代码执行完再重新跳转回目标API

示例代码如下 

386
.model flat, stdcall  ;32 bit memory model
option casemap :none  ;case sensitive

include Inject.inc



.code

InjectCode:
  pop eax
  pushad
  pushfd
  
  mov eax,006a9ec0h
  mov eax,[eax]
  mov eax,[eax+768h]
  mov eax,[eax+0bch]
  .if eax < 4
  popfd
  popad
  jmp offset InjectEnd
  .endif
  mov eax,006a9ec0h
  mov eax,[eax]
  mov eax,[eax+768h]
  add eax,0bch
  dec dword ptr[eax]
  popfd
  popad
  mov edi,20
  mov eax,20
InjectEnd:
  push ecx
  push ebx
  push ebp
  mov ebp,dword ptr [esp+10h]
  push esi
  push edi
  db 0e9h
Label2:
  dd 29d14000h
  
HookCode:
  push eax
Label1:
  mov eax,12345678h
  jmp eax

Inject proc
  LOCAL @hWnd:HWND
  LOCAL @dwPID:DWORD
  LOCAL @hProcess:HANDLE
  LOCAL @pBuff:PVOID
  LOCAL @dwNumber:DWORD 
  LOCAL @hThread:DWORD 
  LOCAL @hUser32:DWORD 
  LOCAL @pfnMsgBox:DWORD 
  LOCAL @dwOld:DWORD
  LOCAL @mymd:MODULEENTRY32 
  LOCAL @hSnapshot:HANDLE
  LOCAL @newAdd:DWORD
    
  ;远程线程注入
  ;1.FindWindow
  invoke FindWindow, offset g_ClassName, NULL
  .if eax == NULL
    ret
  .endif
  mov @hWnd, eax
  
  ;2.获取进程pid
  invoke GetWindowThreadProcessId, @hWnd, addr @dwPID 
  
  ;3.打开进程
  invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE, @dwPID
  .if eax == NULL
    ret
  .endif
  mov @hProcess, eax
  
  ;4.远程申请内存
  invoke VirtualAllocEx,@hProcess, NULL, 1000h, MEM_COMMIT, PAGE_EXECUTE_READWRITE
  .if eax == NULL
    jmp  SAFE_EXIT
  .endif
  mov @pBuff, eax
  
  push @pBuff
  
  ;修改内存保护属性
  invoke VirtualProtect,offset InjectCode, 1000h, PAGE_EXECUTE_READWRITE, addr @dwOld
  
  ;修改对方内存保护属性
  invoke VirtualProtectEx,@hProcess,40d120h, 1000h, PAGE_EXECUTE_READWRITE, addr @dwOld
  
  ;修正hook代码
  mov eax,offset Label1
  inc eax
  mov ebx,@pBuff
  mov [eax],ebx
  
  ;修正注入代码
  mov eax,@pBuff
  add eax,48h
  mov ebx,40d129h
  sub ebx,eax
  sub ebx,5
  
  mov eax,offset Label2
  mov [eax],ebx

  
  ;4.写入劫持代码
  invoke WriteProcessMemory,@hProcess, 
                            40d120h, 
                            offset HookCode, 
                            offset Inject - offset HookCode, 
                            addr @dwNumber
  .if !eax
    jmp   SAFE_EXIT
  .endif
  
  
  
  ;5.写入代码
  invoke WriteProcessMemory,@hProcess, 
                            @pBuff, 
                            offset InjectCode, 
                            offset HookCode - offset InjectCode, 
                            addr @dwNumber
  .if !eax
    jmp   SAFE_EXIT
  .endif

  
SAFE_EXIT: 
  .if @hThread != NULL
    invoke CloseHandle, @hThread
  .endif
  
  .if @hProcess != NULL
    invoke CloseHandle,@hProcess
  .endif
  
  ret

Inject endp

start:

	invoke GetModuleHandle,NULL
	mov		hInstance,eax

  invoke InitCommonControls
	invoke DialogBoxParam,hInstance,IDD_DIALOG1,NULL,addr DlgProc,NULL
	invoke ExitProcess,0

;########################################################################

DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM

	mov		eax,uMsg
	.if eax==WM_INITDIALOG

	.elseif eax==WM_COMMAND
    mov eax, wParam
    .if ax == BTN_INJECT
      invoke Inject
    .endif
	.elseif eax==WM_CLOSE
		invoke EndDialog,hWin,0
	.else
		mov		eax,FALSE
		ret
	.endif
	mov		eax,TRUE
	ret

DlgProc endp



end start